AI is changing cybersecurity, but MSPs don’t need to reinvent their entire security strategy because of it.
That was a key message from Ryan Grant of ESET on this week’s MSP Influencer Primecast. Having worked for an MSP, spent more than two decades at Ingram Micro, and now working on the vendor side with ESET, Grant brings experience from across the channel.
For MSPs navigating AI and cybersecurity, Grant emphasized strengthening the fundamentals while adapting them to new risks.
1. Start With a Security Framework
Grant encouraged MSPs to adopt an established cybersecurity framework, specifically mentioning NIST and CIS.
Rather than approaching each new threat or technology separately, a framework gives MSPs a foundation for evaluating security and helping customers understand what needs to be protected.
Grant also stressed that cybersecurity needs to go beyond basic endpoint protection. As technology environments become more complicated, MSPs can help customers take a more comprehensive approach to protecting their businesses.
2. Extend Cybersecurity to AI
Grant specifically advised MSPs not to create an entirely separate AI practice.
Instead, he believes MSPs should extend their existing cybersecurity practices and governance to include AI. While AI creates different entry points and risks, familiar security considerations—including data governance and access controls—still apply.
He also discussed the emergence of shadow AI, as employees adopt AI tools that businesses may not fully understand or control.
For MSPs, the opportunity is to help customers bring those technologies under the same security and governance disciplines they already use elsewhere.
3. Keep Humans Involved
Grant does not see AI as a silver bullet for cybersecurity.
AI can improve efficiency, help security teams operate at scale, and address issues such as threat fatigue. But Grant emphasized combining AI capabilities with human interaction and oversight.
That becomes even more important because attackers can also use AI.
Grant’s discussion reinforced the importance of multilayered security, along with continued employee education. Technology can strengthen cybersecurity, but organizations still need people who understand what is happening and can respond appropriately.
4. Focus on Prevention
One of Grant’s strongest messages was the importance of preventing attacks rather than concentrating only on responding after they happen.
He described this as working “left of boom”—putting security measures in place before an incident occurs.
His philosophy is straightforward: prevent breaches.
That means cybersecurity cannot simply be treated as a checkbox. Security needs to be managed and monitored, with multiple layers working together.
For MSPs, that role is especially important because small and midsized businesses are focused on running their companies and may not have the resources to keep up with a constantly changing threat environment.
What This Means for MSPs
Grant’s message is not that AI requires MSPs to start over. Instead, it requires them to apply strong cybersecurity fundamentals to a changing technology landscape.
Frameworks, governance, layered protection, human oversight, and prevention remain essential as AI becomes a larger part of business and cybersecurity.